단일 OCI 이미지로 컨테이너와 마이크로 VM을 모두 실행하는 'Pullrun'

Pullrun One OCI image. Any execution target. CLI + runtime under 25 MB. Run the same OCI image as a container, Firecracker microVM, Apple Silicon VM, Kubernetes workload, or AI agent task. No daemon required. No overlayfs. No separate VM images. ⚡ 30-Second Install • 🚀 Quick Start • 🏗️ Architecture • 🎯 Why Pullrun? • 🗺️ Feature Map • ☸️ Kubernetes • 🤖 AI Agents ⚡ What is Pullrun? Pullrun runs the same OCI image as a container or a VM. It stores layers in a content-addressed DAG (no overlayfs), syncs blocks peer-to-peer, and ships as a ~14 MB CLI + ~6 MB runtime daemon. Why this matters: Modern infrastructure uses too many execution engines — Docker for dev, containerd for production, Firecracker for isolation, CRI for Kubernetes, MCP agents for AI. Each has its own image format, storage, and operational model — even though they all run the same OCI images. Pullrun collapses these layers into one runtime. Key differentiators: Containers and VMs from the same image — no separate VM build step, no separate VM image format Content-addressed DAG store — zero-copy mmap reads, deduplicated by content hash, byte-identical across every node P2P image distribution — one registry pull per cluster, rest sync peer-to-peer at LAN speed ~14 MB CLI + ~6 MB runtime daemon (stripped) — no daemon required by default (CLI-only pullrun run ), optional daemon for background services Also included: Kubernetes CRI shim (beta), Docker Compose support, MCP server for AI agents, policy engine (Cosign, SBOM, seccomp), P2P sync layer, and AES-256-GCM encrypted secrets — all in the same binary. # Apple Silicon VM (macOS default) — 3 s pullrun run alpine:3.18 --cmd " echo " --cmd " hello pullrun " --attach -t # Firecracker microVM (Linux) — 400 ms pullrun run alpine:3.18 --backend vm --cmd " echo " --cmd " hello pullrun " --attach -t # Container (Linux) — 400 ms pullrun run alpine:3.18 --cmd " echo " --cmd " hello pullrun " # Windows WSL2 — same image, same command, same store pullrun.exe run alpine:3.18 --cmd " echo " --cmd " hello pullrun " 📦 Install # One command, any platform curl -fsSL https://github.com/pullrun/pullrun/raw/main/install.sh | bash Platform What you get macOS brew tap pullrun/tap && brew install pullrun → native binary, no Xcode Linux APT package or direct download, systemd service (requires runc for containers, /dev/kvm for VMs) Windows pullrun.exe + WSL2 auto-provisioning, runc + Firecracker Manual install options # macOS (Homebrew — pre-built, no build deps) brew tap pullrun/tap && brew install pullrun # From source make build && export PATH= " $PWD /bin: $PATH " # Cross-compile Windows CLI cd cli/pullrun && GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -o pullrun.exe . 🚀 Quick Start # ── Pull any OCI image ────────────────────────────────────────── pullrun pull alpine:3.18 # 968 ms — benchmark script at hack/bench.sh # ── Run as a container (Linux) ───────────────────────────────── pullrun run alpine:3.18 --cmd " echo " --cmd " hello pullrun " # ── Run as a microVM (macOS/Linux) ───────────────────────────── pullrun run alpine:3.18 --backend vm --cmd " echo " --cmd " hello " --attach -t # ── Interactive shell with detach ────────────────────────────── pullrun run alpine:3.18 --tty --attach --cmd /bin/sh # Ctrl-P Ctrl-Q → detach (workload keeps running) # pullrun exec <id> -t /bin/sh → re-attach # ── Background workload ──────────────────────────────────────── pullrun run alpine:3.18 --cmd /bin/sleep --cmd 3600 # ── Build & push (no Docker daemon needed) ───────────────────── pullrun build ./Dockerfile . -t myapp:latest pullrun build ./Dockerfile . -t myapp:latest --platform linux/amd64,linux/arm64 pullrun push < root-digest > ghcr.io/myorg/myimg:latest # ── Export/import for air-gapped ─────────────────────────────── pullrun save < digest > -o myimage.tar pullrun load -i myimage.tar # ── Compose (separate binary) ──────────────────────────────── pullrun-compose up -f myapp/compose.yml # containers (default on Linux) pullrun-compose up -f myapp/compose.yml --backend vm # same compose, VM isolation pullrun-compose logs -f pullrun-compose down # ── Lifecycle ────────────────────────────────────────────────── pullrun list # all workloads (pending/running/exited) pullrun stop < id > pullrun exec < id > /bin/echo hello # Re-attach to a detached workload (allocates a fresh PTY) pullrun exec < id > -t -- /bin/sh # Or, for bidirectional I/O streaming without a new shell: pullrun workload run < id > # ── Image management ────────────────────────────────────────── pullrun images # list pulled images in local DAG store pullrun rmi alpine:3.18 # remove an image, cascade-delete unreachable layers pullrun rmi sha256:abc... # also works by digest # ── GC (DAG store garbage collection) ───────────────────────── pullrun gc # dry-run — report what would be deleted pullrun gc --apply # actually delete unreachable nodes pullrun gc --apply --force # bypass 90% safety guard # ── Events & Stats ───────────────────────────────────────────── pullrun events --types=WORKLOAD_STARTED,POLICY_DENIED pullrun stats < id > # ── Network ──────────────────────────────────────────────────── pullrun network create my-net --subnet 10.43.1.0/24 pullrun run alpine:3.18 --net bridge # ── Secrets ──────────────────────────────────────────────────── pullrun secret create db_password - # from stdin pullrun run myapp:latest --secret db_password # ── Configs ──────────────────────────────────────────────────── pullrun config create nginx.conf ./nginx.conf # from file pullrun config create nginx.conf - # from stdin pullrun run nginx:latest --config nginx.conf # ── Diff & Inspect ───────────────────────────────────────────── pullrun diff < id > pullrun inspect < id > pullrun commit < id > myapp:snapshot # ── Login ────────────────────────────────────────────────────── pullrun login ghcr.io pullrun logout # ── MCP (AI agents) ──────────────────────────────────────────── pullrun mcp # stdio mode (for opencode, Claude Code) pullrun mcp --sse :8080 # SSE mode (for remote agents) # ── P2P sync ─────────────────────────────────────────────────── pullrun-runtime daemon --sync-addr 0.0.0.0:9500 🎯 Why Pullrun? 🏗️ Architecture is Everything Docker's overlayfs store is a filesystem overlay — CVEs in overlayfs (CVE-2023-0386, CVE-2023-32629) can let a container escape to the host. Pullrun's content-addressed DAG store stores layers as-is , verified by content hash. No overlayfs, no escape. Pullrun also mitigates shared-kernel cross-container risks that aren't specific to any storage driver — for example, kernel page-cache bugs like CVE-2026-31431 ("Copy Fail") affect all containers sharing a host kernel, regardless of the storage backend. Per-VM kernel isolation (Firecracker, Apple Virtualization) fully contains these. The DAG store makes the VM path zero-cost: the same image, no separate VM build step. Pullrun is also rootless by default — no sudo needed, no daemon listening on a TCP socket, no attack surface from a central dockerd. 🔥 The Only Runtime with Containers + VMs from the Same Image Backend Isolation Pullrun Docker Podman Linux containers (runc) Process ✅ ✅ ✅ Firecracker microVMs Per-VM kernel ✅ ❌ ❌ Apple Silicon VMs Per-VM kernel ✅ ❌ ❌ Windows WSL2 containers Process ✅ ✅ ❌ Windows Firecracker VMs Per-VM kernel ✅ ❌ ❌ Same image, any isolation level. No separate VM image build step. The OCI manifest IS the VM rootfs. 🧬 Content-Addressed DAG Store Pullrun's store is built on rkyv + mmap . OCI layers are stored once, deduplicated by content hash, and mmap() 'd directly — no tar extraction, no overlayfs, no dockerd process owning the data. A sha256: digest is globally consistent. Every node that has pulled alpine:3.18 stores byte-identical files on disk. This makes P2P sync trivial: blocks are verified by content hash, transferred delta-only, and deduplicated across the entire cluster. 📊 By the Numbers Metric Pullrun Docker First alpine:3.18 pull 968 ms ~2 s Container run latency ~400 ms ~800